42720 matches found
Arbitrary Code Injection
Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TwigView::render process. An attacker can execute arbitrary operating system commands by injecting malicious Twig expressions into mail...
GHSA-4VV7-JJ25-4GH6 Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Summary Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/--class-name ...
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
Summary Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/--class-name ...
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
Impact The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields e.g. description, default values, and property names directly into PHP double-quoted string literals without properly escaping the $ character...
EUVD-2026-44928
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator...
EUVD-2026-44927
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator...
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...
EUVD-2026-44926
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator...
GHSA-3HRF-2GC2-MX32 Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
Summary Kiota versions prior to 1.32.3 and 1.29.1 are affected by a code-generation injection vulnerability in the C XML documentation-comment sink the description, externalDocs label, and externalDocs link fields emitted as /// … comments. When text from an OpenAPI description is written into...
CVE-2026-16801
Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...
CVE-2026-16800
Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...
CVE-2026-16801
Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...
CVE-2026-16801
Devolutions PowerShell Universal versions 2026.2.2 and earlier are vulnerable to a Code Injection flaw in the variables feature. An authenticated user with variable write permissions can execute arbitrary PowerShell code by providing a crafted variable value that is not properly escaped when writ...
EUVD-2026-48608
Improper control of generation of code 'Code Injection' in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when...
CVE-2026-16800
Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...
CVE-2026-16800
Devolutions PowerShell Universal versions prior to 2026.2.3 (specifically 2026.2.2 and earlier) are vulnerable to a Code Injection flaw in the schedule feature. An authenticated user with schedule creation permissions can execute arbitrary PowerShell code by providing crafted schedule parameter n...
EUVD-2026-48607
Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...
CVE-2026-16800
Improper control of generation of code 'Code Injection' in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a...